CVE-2025-28170.md

Vulnerability: Incorrect Access Control on Grandstream GXP1628

Affected Product:

• Grandstream GXP1628 VoIP Phone Firmware Version: <=1.0.4.130

Vulnerability Type:

• Directory Listing
• Sensitive Information Leak

Description:

The Grandstream GXP1628 VoIP device is vulnerable to a directory listing issue. By accessing specific directories like /webapp/, /cgi-bin/, and /json/contents/, an attacker can enumerate sensitive files and potentially gain unauthorized access to the contents. This vulnerability can expose important files such as configuration files, logs, or other sensitive data, which could be leveraged for further attacks.

Steps to Reproduce:

1. Navigate to the device's IP address and append /webapp/, /cgi-bin/, or /json/contents/ to the URL.
2. The device will return a directory listing, revealing list of files that should not be publicly accessible.
3. These listed files can be access.

Example:

• http://<device_ip>/webapp/hosted.html
• http://<device_ip>/cgi-bin/api-make_call

Impact:

• Unauthorized access to sensitive files
• Possible exposure of configuration or log data
• May lead to further attacks (e.g., information disclosure, system compromise)

Mitigation:

• Disable directory listing in the device’s web server configuration.
• Apply a firmware update from Grandstream that addresses this issue, if available. (limited knowledge but not existed in latest firmware)

Reference:

• Grandstream's official firmware - https://www.grandstream.com/support/firmware
• CVE-2025-28170